Quick answer

Online lending apps may demand payment through lawful and reasonable means, but they may not threaten, insult, publicly shame, deceive, or misuse your personal data. They generally may not contact people in your phonebook for collection unless those people are actual guarantors or co-makers. A character reference does not become liable merely because you supplied their name or number.

To stop the harassment:

Save the evidence before blocking numbers or uninstalling the app.
Revoke unnecessary app permissions and secure your accounts.
Send the lender a written demand to stop unlawful collection and to communicate only through a specified channel.
Report unfair collection to the Securities and Exchange Commission (SEC).
File a privacy complaint with the National Privacy Commission (NPC) if personal data or contacts were misused.
Report credible threats, impersonation, extortion, fraud, or account compromise to law enforcement immediately.

Harassment does not automatically erase a valid loan. Continue addressing any legitimate balance, but pay only through a verified company channel and ask for a complete written computation.

What online lenders and collectors are not allowed to do

The Financial Products and Services Consumer Protection Act, Republic Act No. 11765, protects financial consumers’ rights to fair treatment, data privacy, disclosure, and timely complaint handling. It prohibits abusive collection or debt-recovery practices. A regulated provider is also responsible for the conduct of its employees and agents and may be solidarily liable with accredited third-party collectors.

Under SEC Memorandum Circular No. 18, Series of 2019, unfair practices include:

Using or threatening violence or other criminal means to harm a person, reputation, or property
Threatening an action that cannot legally be taken
Using obscenities, insults, or profane language to abuse the borrower
Publishing or disclosing borrowers’ names and personal information to shame them
Communicating false credit information or failing to disclose that a debt is disputed
Using false representations or deceptive means to collect a debt or obtain information
Contacting the borrower before 6:00 a.m. or after 10:00 p.m., subject to the circular’s limited exceptions—such as an account more than 15 days past due or the borrower’s express, recorded consent that those times are the only reasonable opportunities for contact
Contacting people in the borrower’s phone contact list who were not named as guarantors or co-makers, notwithstanding purported consent to access the contact list

Even when late-hour contact falls within an exception, threats, insults, deception, public shaming, and other abusive conduct remain prohibited.

The SEC rules apply not only to the lending or financing company but also to collection agencies, service providers, and other agents acting for it.

Your contacts cannot be used as collection targets

The 2026 joint advisory of the DICT, NPC, and SEC states that contacting people on a borrower’s contact list other than guarantors is prohibited. For debt collection, lenders and their agents may contact a guarantor—not everyone whose details happen to be stored on the borrower’s phone.

The distinction matters:

A guarantor expressly agrees to answer for the loan if the borrower defaults.
A co-maker signs or otherwise assumes liability under the loan.
A character reference, emergency contact, relative, co-worker, supervisor, or friend does not become liable merely because their information was provided.

Online lending platforms must provide separate interfaces for character references and guarantors. A guarantor must have consented to that role. Access to a borrower’s contacts does not turn every contact into a guarantor and does not authorize mass messaging or debt-shaming.

Data-privacy rules for lending apps

The Data Privacy Act of 2012, Republic Act No. 10173, requires personal-data processing to have a lawful basis and to observe transparency, legitimate purpose, and proportionality.

Under NPC Circular No. 20-01, as amended, and the government’s 2026 advisory:

An app may not demand unnecessary permissions.
Collection and use of personal data must be suitable, necessary, and not excessive.
Unrestricted or disproportionate processing of phone contacts is prohibited.
Contact data may not be used to harass the borrower or collect from people who are not guarantors.
Camera or gallery access must be limited to a specified legitimate purpose, such as identity verification, and photographs may not be altered or used for shaming.
Personal data must be retained only as long as necessary for its stated purpose, legal claims, or a period required by law.
When an app permission is no longer needed, the platform should prompt the user to disable or revoke it.
Deceptive interfaces—such as pre-ticked consent boxes or designs that make consent easy to give but difficult to withdraw—may undermine valid consent.

A privacy complaint can cover not only disclosure to your contacts but also excessive permissions, unauthorized use of photographs, public posting of loan information, deceptive consent, refusal to correct inaccurate data, and continued processing without a lawful basis.

What to do immediately

1. Preserve the evidence first

Before blocking numbers, deleting messages, changing app permissions, or uninstalling the app, save:

Screenshots showing the full message, sender, date, and time
Screen recordings showing the message thread, account profile, or public post
Call logs, voicemails, and the dates and times of calls
URLs and screenshots of social-media posts or group messages
The app’s name, developer, download-page URL, and version
The lender’s corporate name, address, SEC registration details, and certificate of authority, if shown
Loan agreement, disclosure statement, repayment schedule, receipts, and account history
The app’s privacy notice, consent screens, and requested permissions
Proof that relatives, friends, employers, or co-workers were contacted
Names and statements of people who received collection messages
Your written complaints to the lender and its responses
Any fake-looking warrant, subpoena, court notice, police notice, or barangay notice

Keep original files when possible. Back them up somewhere the app cannot access. Avoid cropping out phone numbers, usernames, dates, or URLs that may help identify the sender.

If someone you know received a message, ask them to preserve the original message and its metadata—not merely forward the text to you.

2. Limit further access to your phone and accounts

After preserving the evidence:

Open your phone settings and revoke the app’s access to contacts, photos, camera, microphone, location, calendar, call logs, and storage unless genuinely necessary.
Review permissions granted to related apps.
Change passwords for your email, social-media, cloud-storage, banking, and e-wallet accounts if compromise is possible.
Enable multi-factor authentication.
Sign out unknown devices and review recent account activity.
Ask recipients not to reply to the collector, click links, or provide information about you.
Report and request removal of shaming posts through the relevant platform.
Block abusive numbers after documenting them.

Uninstalling the app may stop new device access, but it does not erase data already copied by the operator. Preserve proof and submit a written privacy request before or after uninstalling.

3. Send a written notice to the lender

Use the lender’s official consumer-assistance or data-protection contact. Keep proof of delivery. A concise notice may say:

I dispute and object to your abusive collection conduct. Stop contacting persons who are not my guarantors or co-makers, stop disclosing my loan information, and stop all threats, insults, deceptive representations, and unlawful processing of personal data. Communicate with me only through [email/address]. Please identify the lending company, collection agency, account reference, authority to collect, and complete computation of the amount claimed. Preserve all records relating to this account and confirm the action taken on this complaint.

If the amount is disputed, identify the specific issue—for example, an uncredited payment, undisclosed fee, unauthorized loan, or incorrect balance. Do not state that the entire debt is invalid unless you have a factual and legal basis.

A request to stop harassment is not necessarily a refusal to pay. You may separately propose a realistic payment arrangement without surrendering your complaint.

Where to report the conduct

SEC: unfair collection by lending or financing companies

Submit a complaint to the SEC Financing and Lending Companies Department through the official SEC iMessage portal. Select the service or department relating to financing and lending companies and retain the ticket number.

Attach organized evidence, including:

Your identification and contact details
The lender’s corporate and app names
Account or loan reference
A chronological statement of events
Copies of the loan documents and payment records
Screenshots, call logs, recordings, and posts
Evidence of messages sent to third parties
Your prior complaint to the lender and any response
The specific relief requested, such as stopping third-party contact and correcting the account

The 2026 joint advisory also identifies the SEC hotline 1-4732 (1-4SEC) for unfair debt-collection concerns.

Check whether the operator is registered and authorized through the SEC’s official Check with SEC service. Corporate registration alone does not necessarily mean the company has authority to operate as a lending or financing company or to use a particular online lending platform.

NPC: misuse or disclosure of personal data

For unlawful access to contacts, public shaming, unauthorized messages to third parties, misuse of photographs, or other privacy violations, use the NPC’s current formal complaint procedure and complaint-affidavit form.

The NPC currently instructs complainants to:

Download and complete the current complaint form.
Print and sign it.
Have it notarized.
Submit it in person, by courier, or as a scanned copy by email to complaints@privacy.gov.ph.

The NPC announced a new complaint-affidavit template effective July 1, 2025, so use the form presently posted on its website rather than an old downloaded copy. Check the NPC’s current schedule of fees and requirements before filing.

Describe the personal data involved, how it was obtained or used, who received it, when you learned of the violation, the harm caused, and the relief requested. Attach the privacy notice and consent screens if available.

Police, NBI, or DICT: threats, fraud, impersonation, or cyber incidents

Do not wait for the SEC or NPC process if there is a credible threat of physical harm, extortion, stalking, identity theft, account takeover, or impersonation of police, courts, lawyers, or government officials.

For immediate danger, call 911 or go to the nearest police station.

The 2026 government advisory lists these reporting channels:

DICT Cyber Hotline: 1326@dict.gov.ph
NBI Cybercrime Division: ccd@nbi.gov.ph; (02) 8523-8231 to 38
PNP Anti-Cybercrime Group: acg@pnp.gov.ph; onlinecims.ocs@gmail.com; (02) 8723-0401 local 7491

The proper criminal charge depends on the exact words, conduct, medium, intent, and evidence. Threats, coercion, defamatory publication, fraud, identity misuse, or unjust vexation may implicate different laws. Let investigators or counsel assess the facts instead of guessing the offense in your complaint.

Can a borrower be arrested simply for not paying?

No person may be imprisoned merely for debt under Article III, Section 20 of the 1987 Constitution. A collector cannot lawfully have you arrested simply because an ordinary loan is unpaid.

However, that protection does not erase the debt or prevent a lender from filing a civil collection case. Separate conduct—such as issuing a check that may fall under a penal law, falsifying documents, identity fraud, or disobeying a lawful court order—must be evaluated independently. Do not ignore genuine court papers.

Collectors cannot issue arrest warrants, court summonses, hold-departure orders, or garnishment orders themselves. If you receive a document claiming to come from a court or government office, contact that office using independently verified details. Do not use only the number printed in the suspicious message.

How to deal with the unpaid balance safely

Harassment and the underlying loan are separate issues. Even when collection methods are unlawful, a valid principal obligation may remain payable.

Ask the lender in writing for:

A copy of the signed or electronically accepted loan agreement
The disclosure statement
An itemized computation of principal, interest, penalties, fees, and payments
The lender’s legal corporate name and SEC authority
The collector’s authority to act for the lender
A verified company payment channel
Written confirmation of any restructuring or settlement
An official receipt and certificate or confirmation of full payment

Do not send money to an individual collector’s personal bank or e-wallet account without independently confirming that the lender authorized it. Do not share passwords, one-time PINs, card security codes, or remote access to your phone.

If settling, obtain written terms stating the exact amount, due date, effect of payment, treatment of the remaining balance, and whether the account will be reported as settled or fully paid. Keep every receipt.

Common mistakes to avoid

Deleting the app or messages before preserving evidence
Responding to abuse with threats or defamatory posts of your own
Assuming that blocking a number ends the lender’s access to copied data
Paying an unknown collector without verifying authority and payment details
Giving an OTP, password, PIN, or screen-sharing access
Ignoring an actual summons because earlier messages were fake
Treating a character reference as a guarantor without checking the signed documents
Filing only a social-media complaint instead of using official SEC, NPC, or law-enforcement channels
Sending unorganized screenshots without dates, account details, or an event timeline
Assuming harassment automatically cancels the loan
Agreeing to a settlement by phone without obtaining written terms
Downloading complaint forms from unofficial sites when an updated agency form is required

When legal help is urgent

Consult a lawyer promptly—or approach the Public Attorney’s Office if you qualify—when:

You receive a genuine summons, subpoena, warrant, or court order.
The lender files a civil or criminal case.
Someone threatens violence, visits your home or workplace, or stalks you.
Intimate images, altered photographs, identification documents, or sensitive personal information are published.
Money or accounts were taken through identity theft or unauthorized transactions.
The lender claims you signed as a guarantor or co-maker but you dispute the signature or consent.
Your employer takes action because of the messages.
The amount involves substantial or unexplained charges.
You are being pressured to sign a waiver, confession, promissory note, or settlement you do not understand.
A filing or response deadline appears in an official document.

Court deadlines depend on the type of case and the document served. Read the document immediately and obtain advice rather than assuming a standard deadline applies.

Frequently asked questions

Can the app text my family, friends, or employer?

Generally not for debt collection unless the recipient is an actual guarantor or co-maker. A relative, friend, co-worker, employer, or character reference is not automatically liable. Preserve the message and consider complaints to both the SEC and NPC.

Does clicking “Allow contacts” authorize the app to message everyone?

No. Permission to access contacts is not unlimited authority to use them for harassment or mass collection. Processing must remain lawful, necessary, transparent, and proportionate. The SEC rule treats contact with people other than named guarantors or co-makers as unfair collection notwithstanding purported consent.

Can collectors post my name, photo, ID, or loan balance online?

Public shaming and unnecessary disclosure may violate SEC collection rules and data-privacy law. Save the post, URL, account name, date, comments, and sharing history before requesting removal.

May a collector call after 10:00 p.m.?

The SEC rule generally treats contact before 6:00 a.m. or after 10:00 p.m. as unreasonable, but contains limited exceptions, including accounts more than 15 days past due or recorded express consent that those times are the only reasonable opportunities for contact. Those exceptions do not permit threats, insults, deception, or public shaming.

Can a collector threaten to file a case?

A lender may truthfully state that it intends to pursue a legally available remedy. It may not threaten an action that cannot legally be taken, pretend that a case or warrant already exists, or impersonate a court, lawyer, police officer, or government agency.

Should I block the collector?

Preserve the evidence and provide one controlled written communication channel first. You may then block abusive numbers, especially when contact is repetitive or threatening. Blocking does not resolve a valid balance, so continue communicating through the verified company channel.

Will an SEC or NPC complaint erase my debt?

Not automatically. The complaint addresses unlawful collection or data processing. The validity and amount of the loan must be assessed separately from the collector’s misconduct.

What if I never borrowed from the app?

State in writing that the loan is unauthorized, demand the application and disbursement records, and secure your accounts. Report possible identity theft or fraud to the lender and appropriate law-enforcement authorities. Do not pay merely because someone is threatening you.

Official sources

This article provides general legal information, not advice for a particular case. Outcomes and available remedies depend on the loan documents, communications, identities of the parties, and other facts. Official sources and procedures were checked as of July 27, 2026.